Class: AttackBundle

A bundle of ATT&CK objects, as MITRE publishes each release of a domain: the domain’s collection first, then the objects it holds.

URI: attack:AttackBundle

 classDiagram
    class AttackBundle
    click AttackBundle href "../AttackBundle/"
      StixBundle <|-- AttackBundle
        click StixBundle href "../StixBundle/"
      
      AttackBundle : id
        
      AttackBundle : objects
        
          
    
        
        
        AttackBundle --> "1..*" StixObject : objects
        click StixObject href "../StixObject/"
    

        
      AttackBundle : type
        
      

Inheritance

• StixBundle
  • AttackBundle

Slots

Name	Cardinality and Range	Description	Inheritance
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixBundle
type	1 String	The STIX type name of the object, such as attack-pattern	StixBundle
objects	1..* StixObject	The STIX objects in the bundle	StixBundle

Notes

• It adds no slot to StixBundle, which stays the schema’s tree root; the generated JSON Schema takes AttackBundle as its top class.

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:AttackBundle
native	attack:AttackBundle

LinkML Source

Direct

name: AttackBundle
description: 'A bundle of ATT&CK objects, as MITRE publishes each release of a domain:
  the domain''s collection first, then the objects it holds.'
notes:
- It adds no slot to StixBundle, which stays the schema's tree root; the generated
  JSON Schema takes AttackBundle as its top class.
from_schema: https://w3id.org/lmodel/attack
is_a: StixBundle

Induced

name: AttackBundle
description: 'A bundle of ATT&CK objects, as MITRE publishes each release of a domain:
  the domain''s collection first, then the objects it holds.'
notes:
- It adds no slot to StixBundle, which stays the schema's tree root; the generated
  JSON Schema takes AttackBundle as its top class.
from_schema: https://w3id.org/lmodel/attack
is_a: StixBundle
attributes:
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: AttackBundle
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^bundle--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: AttackBundle
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: bundle
  objects:
    name: objects
    description: The STIX objects in the bundle.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:objects
    owner: AttackBundle
    domain_of:
    - StixObservedData
    - StixBundle
    range: StixObject
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1